Suspicious Apple Script Execution

[rule]
description = """
Identifies the execution of the Apple script interpreter (osascript) process with suspicious command line arguments.
This behavior is consistent with an attacker executing malicious scripts for execution or command and control.
"""
id = "7b9d544a-5b2a-4f0d-984a-cdc89a7fad25"
license = "Elastic License v2"
name = "Suspicious Apple Script Execution"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/Mythic"]
version = "1.0.31"

query = '''
process where event.action == "exec" and
 process.name == "osascript" and
 process.args like~ "JavaScript" and
 process.command_line like~ "*eval(*" and
 process.command_line like~ ("*initWithDataEncoding*", "*dataWithContentsOfURL*", "*URLWithString*", "*http*")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.10.2"